This listing of claims will replace all prior versions and listings of claims in 
the application: 

AMENDMENTS TO THE CLAIMS 

1 . (Original) A method of tracing data traffic on a network, the method 
comprising: 

at the transport layer of a protocol stack residing on a first device in the 
network, detecting a transmission or receipt of data to or from a second device on the 
network; and in response to the transmission or receipt being detected, recording the 
transmission or receipt as an entry in a trace log, wherein the trace log is accessible to 
determine the volume of data traveling over a network. 

2. (Original) The method of claim 1, wherein the protocol stack is a TCP/IP 

stack. 

3. (Currently Amended) The method of claim 1, wherein the detection step 
further comprises the step of detecting the presence of an input/output packet 
representing the transmission or receipt. 

4. (Previously Presented) A method of tracing a transmission of data over a 
computer network comprising: detecting a transport-layer request to transmit an 
input/output packet; searching the input/output packet to determine an identity of a 
process that created the input/output packet; and storing in a trace log an entry 
representing the request, wherein the entry comprises the identity of the process, and 
wherein the trace log is accessible to determine a volume of data being transmitted 
over the network. 

5. (Original) The method of claim 4, further comprising: detecting an 
acknowledgment of the transmission; and in response to the detection of the 
acknowledgment, storing in the trace log an entry representing the completion of the 
transmission. 

6. (Previously Presented) A method of tracing a receipt of data from a 
computer network comprising: detecting a transport-layer request to transmit a packet 
for an input/output connection to a port; searching the packet to determine an identity 
of a process that created the packet; and in response to the detection of a receipt of 
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data at the port, storing in a trace log an entry representing the receipt of the data, 
wherein the entry comprises the process identification, and wherein the trace log is 
accessible to determine a volume of the data being transmitted over the network. 

7. (Original) The method of claim 6, further comprising: creating a 
connection object representing the opening of the port connection by the process; 
copying the process identification from the connection object into a transport control 
block associated with the port; and in response to the detection of the receipt of data at 
the port, copying the process identification into the trace log. 

8. (Original) The method of claim 7, further comprising: copying the 
process identification from the connection object into the transport control block so 
that the process identification is contiguous with the rest of the data in the transport 
control block. 

9. (Previously Presented) The method of claim 8, further comprising: 
detecting the presence of an input/output request packet indicating that the data 
receipt is complete; and in response to the detection of the completion input/output 
request packet, making an entry representing the receipt of the data into a trace log. 

10. (Currently Amended) A facility for tracing data traffic on a network at 
the transport layer, the facility comprising: an identifying means for identifying a 
process causing a transport-layer request to transmit data via the network; and a 
logging means in communication with the identifying means for logging an event, 
wherein the event comprises the identification of the process and wherein the logging 
means is useable to determine a volume of data traveling over the network. 

11. (Original) The apparatus of claim 10 wherein the identifying means 
further comprises means for communicating with a transport layer of a protocol stack. 

12. (Original) A computer-readable medium having stored thereon computer- 
executable instructions for performing steps comprising: at the transport layer of a 
protocol stack residing on a first device in the network, detecting a transmission or 
receipt of data to or from a second device on the network; and in response to the 
transmission or receipt being detected, recording the transmission or receipt as an 
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entry in a trace log, wherein the trace log is accessible to determine the volume of 
data traveling over a network. 

13. (Original) The computer-readable medium of claim 12, wherein the 
protocol stack is a TCP/IP stack. 

14. (Original) The computer-readable medium of claim 12, having further 
computer-executable instructions for performing the step of detecting the presence of 
an input/output packet representing the transmission or receipt. 

15. (Previously Presented) A computer-readable medium having stored 
thereon computer-executable instructions for performing steps comprising: detecting 
a transport-layer request to transmit an input/output packet; searching the input/output 
packet to determine an identity of a process that created the input/output packet; and 
storing in a trace log an entry representing the request, wherein the entry comprises 
the identity of the process, and wherein the trace log is accessible to determine a 
volume of data being transmitted over the network. 

16. (Original) The computer-readable medium of claim 15, having further 
computer-executable instructions for performing the step of detecting the presence of 
the input/output packet at the transport layer of a protocol stack. 

17. (Original) The computer-readable medium of claim 15, having further 
computer-executable instructions for performing the step of detecting an 
acknowledgment, storing in the trace log an entry representing the completion of the 
transmission. 

18. (Previously Presented) A computer-readable medium having stored 
thereon computer-executable instructions for performing the steps comprising: 
detecting a transport-layer request to transmit a packet for an input-output connection 
to a port; searching the packet to determine an identity of a process that created the 
packet; and in response to the detection of a receipt of data at the port, storing in a 
trace log an entry representing the receipt of the data, wherein the entry comprises 
process identification, and wherein the trace log is accessible to determine the volume 
of the data being transmitted over the network. 
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19. (Original) The computer-readable medium of claim 18, having further 
computer-executable instructions for performing the steps of: creating a connection 
object representing the opening of the port connection by the process; copying the 
process identification from the connection object into a transport control block 
associated with the port; and in response to the detection of the receipt of data at the 
port, copying the process identification into the trace log. 

20. (Original) The computer-readable medium of claim 18, having further 
computer-executable instructions for performing the step of copying the process 
identification from the connection object into the transport control block so that the 
process identification is contiguous with the rest of the data in the transport control 
block. 

21. (Original) The computer-readable medium of claim 18, having further 
computer-executable instructions for performing the steps of: detecting the presence 
of an input/output request packet indicating that the data receipt is complete; and in 
response to the detection of the completion input/output request packet, storing in the 
trace log an entry representing the receipt of the data. 

22. (Previously Presented) The method of claim 1, wherein the transmission 
of data is recorded at the completion of the transmission indicated by an 
acknowledgment from the first device. 

23. (Canceled) 

24. (Previously Presented) The method of claim 4, wherein the identity of the 
process includes a port number or an IP address relating to the transmission. 
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